My Lords, as the Prime Minister traipses around European capitals, seeking to get an extension and, I hope, prevent a no-deal Brexit, I very much hope that today’s relatively short debate will be wasted time. None the less, I was somewhat surprised that this SI was before us. It was only on 18 February this year that we debated the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019, so I was somewhat surprised that we needed another one.
4.15 pm
Of course, I was aware that since that was laid in November last year, a number of changes made last December had had an impact, so I understand why some aspects of the new SI were necessary. Nevertheless, I was somewhat surprised to be told in a memo from the department that this SI was “a convenient vehicle” to sweep up a number of other small changes which, for various reasons, it had not been possible to include in earlier SIs. For example, I fail to understand why the previous SI did not, as does this one, replace “competent national authority” with references to the Information Commissioner. We knew that we had to do that back in November, so surely we should have done it in the previous SI.
Equally, why are we only now revoking EU legislation establishing the body to which the Minister referred, BEREC, and our membership of the European Regulators Group for Audiovisual Media Services? Why are we only now dealing with the .eu top-level domains? These are all issues that we knew we had to deal with last November, when the previous instrument was laid. What were the “various reasons” why the
provision and some others contained in the SI could not have been it included the previous one? That does not give us confidence that we do not have before us a further example of rushed legislation. Can he assure your Lordships’ House that this is the last SI on these issues that will come before us?
The new SI referred once again to the changes under GDPR, so it provides another opportunity for the Minister to give once-and-for-all clarity on the question raised several times in the February debate. After a no-deal Brexit, a UK data controller doing business in EEA countries will, because of the reciprocal obligations, need representation in the EEA. Can he clarify whether that is just one representative in the EEA or does it require representatives in each of the EEA member states in which the UK data controller is doing business? Clearly, that has a huge potential impact on the cost of doing business for UK businesses and leads to the question of why it was not included in the explanation of the costs.
Does the Minister acknowledge that the creation of a new data protection regime in the UK—the UK GDPR—presents additional complexities for controllers and processors who are caught up by both European and UK law? I accept that initially there may be very little difference between the two, but in time they will begin to diverge and that will provide added burdens on UK businesses. Surely that should have led to some comment in an impact assessment which, once again, we see is missing in toto from the SI.
I may have missed it, and I apologise if I have, but I can find no reference in the SI to Article 81 of the GDPR. This relates to situations when the courts in two or more EU countries have both issued proceedings against the same controller or processor. In such circumstances, under GDPR Article 81, one of the courts may well decide to decline jurisdiction or suspend proceedings until the other court has made its determination. As these provisions are now revoked, will that not increase the possibility of costly duplication of court action in both the UK and another EU court?
Finally, the SI relates to two recent changes approved by the EU Council in December last year, as I mentioned at the beginning of my contribution: the Electronic Communications Code and the revised remit for BEREC—the Body of European Regulators for Electronic Communications. These have led to some new initiatives. One is mentioned in the SI and the Minister has given us a detailed explanation of it: the introduction of price caps on intra-EU calls and text messages. I accept entirely the point the Minister made: this will have precious little impact on consumers within the UK, who can use alternative means of communication.
However, the other change is not mentioned: the plan being made within the Electronic Communications Code and under the new remit for BEREC that will require all EU member states to set up public warnings—systems that would send alerts to people’s mobile phones in the event of natural disasters, terrorist attacks or other major emergencies in the area. The requirement
is that they be in place within three and a half years of the ECC coming into force. Several countries already have some such systems in place—I am sure the Minister already knows this—and in 2013 the Cabinet Office in the UK announced that trials of such a scheme would begin. Given that we are dropping out of involvement in the ECC, could he tell the House whether the Government have plans—notwithstanding the plan to leave the European Union—for such a system to be introduced within the UK, given that trials started way back in 2013?
With those few questions, I just say that I very much hope that this short debate will have been wasted.